deploy.yml

name: Deploy

on:
  workflow_call:
    inputs:
      environment:
        required: true
        type: string
        default: "stage"

concurrency:
  group: deploy_workflow-${{ github.ref }}
  cancel-in-progress: false

permissions:
  id-token: write # This is required for requesting the JWT
  contents: read # This is required for actions/checkout
  actions: read     # This is required for provenance

env:
  GCP_WORKLOAD_IDENTITY_PROVIDER: "projects/224545243904/locations/global/workloadIdentityPools/gh-nuclia/providers/gh-nuclia-provider"
  GCP_SERVICE_ACCOUNT: "github-actions@nuclia-internal.iam.gserviceaccount.com"
  HELM_VERSION: v3.15.3

jobs:

  generate-short-sha:
    name: Generate short sha
    runs-on: ubuntu-24.04
    outputs:
      SHORT_SHA: ${{ steps.env-vars.outputs.SHORT_SHA }}
    steps:
      
      - name: Checkout repository
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0

      - name: Calculate short sha
        id: env-vars
        run: |-
          HASH=`git rev-parse --short HEAD`
          echo "SHORT_SHA=$HASH" >> $GITHUB_OUTPUT

  build-python-image:
    name: Build Python image
    needs: generate-short-sha
    uses: ./.github/workflows/_build-img-nucliadb.yml
    with:
      file: Dockerfile
      image-name: nucliadb_hosted
      image-version: ${{ needs.generate-short-sha.outputs.SHORT_SHA }}
    secrets: inherit

  build-nidx-image:
    name: Build nidx image
    needs: generate-short-sha
    uses: ./.github/workflows/_build-img-nucliadb.yml
    with:
      file: Dockerfile.nidx
      image-name: nidx
      image-version: ${{ needs.generate-short-sha.outputs.SHORT_SHA }}
    secrets: inherit

  upload-chart-nucliadb-shared:
    name: Deploy nucliadb shared
    runs-on: ubuntu-24.04
    env:
      COMPONENT_NAME: nucliadb_shared
    steps:
      - name: Generate a token
        id: app-token
        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
        with:
          app-id: ${{ secrets.GHAPP_ID_NUCLIABOT }}
          private-key: ${{ secrets.PK_GHAPP_NUCLIABOT }}
          owner: nuclia

      - name: Checkout repository
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0

      - name: Checkout tooling repository
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          repository: nuclia/tooling
          ref: main
          path: tooling
          token: ${{ steps.app-token.outputs.token }}

      - name: Authenticate to Google Cloud
        id: gcp-auth
        uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3.0.0
        with:
          workload_identity_provider: "${{ env.GCP_WORKLOAD_IDENTITY_PROVIDER }}"
          service_account: "${{ env.GCP_SERVICE_ACCOUNT }}"
          token_format: access_token

      - name: Login to Google Artifact Registry
        uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
        with:
          registry: europe-west4-docker.pkg.dev
          username: oauth2accesstoken
          password: ${{ steps.gcp-auth.outputs.access_token }}

      - name: Calculate short sha
        id: env-vars
        run: |-
          HASH=`git rev-parse --short HEAD`
          echo "short_sha=$HASH" >> $GITHUB_OUTPUT

      - name: Set helm package image
        id: version_step
        run: |-
          VERSION=`cat VERSION`
          VERSION_SHA=$VERSION-${{ steps.env-vars.outputs.short_sha }}
          echo "version_number=$VERSION_SHA" >> $GITHUB_OUTPUT

      - name: Build and push helm chart
        uses: ./tooling/.github/actions/build-helm-chart
        with:
          component: ${{ env.COMPONENT_NAME }}
          chart-version: ${{ steps.version_step.outputs.version_number }}
          helm-chart-url: ${{ secrets.HELM_CHART_URL }}
          chart-dir: "./charts/${{ env.COMPONENT_NAME }}"
          helm-version: ${{ env.HELM_VERSION }}
          push-to-artifact-registry: true

  upload-charts-nucliadb-component:
    name: Upload NucliaDB component charts
    runs-on: ubuntu-24.04
    outputs:
      version_number: ${{ steps.version_step.outputs.version_number }}
    needs:
      - build-python-image
    strategy:
      matrix:
        component:
          - ingest
          - reader
          - search
          - train
          - writer
    steps:
      - name: Generate a token
        id: app-token
        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
        with:
          app-id: ${{ secrets.GHAPP_ID_NUCLIABOT }}
          private-key: ${{ secrets.PK_GHAPP_NUCLIABOT }}
          owner: nuclia

      - name: Checkout repository
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0

      - name: Checkout tooling repository
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          repository: nuclia/tooling
          ref: main
          path: tooling
          token: ${{ steps.app-token.outputs.token }}

      - name: Authenticate to Google Cloud
        id: gcp-auth
        uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3.0.0
        with:
          workload_identity_provider: "${{ env.GCP_WORKLOAD_IDENTITY_PROVIDER }}"
          service_account: "${{ env.GCP_SERVICE_ACCOUNT }}"
          token_format: access_token

      - name: Login to Google Artifact Registry
        uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
        with:
          registry: europe-west4-docker.pkg.dev
          username: oauth2accesstoken
          password: ${{ steps.gcp-auth.outputs.access_token }}

      - name: Calculate short sha
        id: env-vars
        run: |-
          HASH=`git rev-parse --short HEAD`
          echo "short_sha=$HASH" >> $GITHUB_OUTPUT

      - name: Set helm package image
        id: version_step
        run: |-
          VERSION=`cat VERSION`
          VERSION_SHA=$VERSION-${{ steps.env-vars.outputs.short_sha }}
          echo "version_number=$VERSION_SHA" >> $GITHUB_OUTPUT

      - name: Build and push helm chart
        uses: ./tooling/.github/actions/build-helm-chart
        with:
          component: nucliadb_${{ matrix.component }}
          image-name: nucliadb_hosted
          image-version: ${{ steps.env-vars.outputs.short_sha }}
          chart-version: ${{ steps.version_step.outputs.version_number }}
          helm-chart-url: ${{ secrets.HELM_CHART_URL }}
          chart-dir: "./charts/nucliadb_${{ matrix.component }}"
          helm-version: ${{ env.HELM_VERSION }}
          push-to-artifact-registry: true

  upload-chart-nidx:
    name: Upload nidx chart
    env:
      COMPONENT_NAME: nidx
    runs-on: ubuntu-24.04
    needs:
      - build-nidx-image
    steps:
      - name: Generate a token
        id: app-token
        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
        with:
          app-id: ${{ secrets.GHAPP_ID_NUCLIABOT }}
          private-key: ${{ secrets.PK_GHAPP_NUCLIABOT }}
          owner: nuclia

      - name: Checkout repository
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0

      - name: Checkout tooling repository
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
        with:
          repository: nuclia/tooling
          ref: main
          path: tooling
          token: ${{ steps.app-token.outputs.token }}

      - name: Authenticate to Google Cloud
        id: gcp-auth
        uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3.0.0
        with:
          workload_identity_provider: "${{ env.GCP_WORKLOAD_IDENTITY_PROVIDER }}"
          service_account: "${{ env.GCP_SERVICE_ACCOUNT }}"
          token_format: access_token

      - name: Login to Google Artifact Registry
        uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
        with:
          registry: europe-west4-docker.pkg.dev
          username: oauth2accesstoken
          password: ${{ steps.gcp-auth.outputs.access_token }}

      - name: Calculate short sha
        id: env-vars
        run: |-
          HASH=`git rev-parse --short HEAD`
          echo "short_sha=$HASH" >> $GITHUB_OUTPUT

      - name: Set helm package image
        id: version_step
        run: |-
          VERSION=`cat VERSION`
          VERSION_SHA=$VERSION-${{ steps.env-vars.outputs.short_sha }}
          echo "version_number=$VERSION_SHA" >> $GITHUB_OUTPUT

      - name: Build and push helm chart
        uses: ./tooling/.github/actions/build-helm-chart
        with:
          component: ${{ env.COMPONENT_NAME }}
          image-name: ${{ env.COMPONENT_NAME }}
          image-version: ${{ steps.env-vars.outputs.short_sha }}
          chart-version: ${{ steps.version_step.outputs.version_number }}
          helm-chart-url: ${{ secrets.HELM_CHART_URL }}
          chart-dir: "./charts/${{ env.COMPONENT_NAME }}"
          helm-version: ${{ env.HELM_VERSION }}
          push-to-artifact-registry: true

  deploy-nucliadb-components:
    name: Deploy NucliaDB components
    runs-on: ubuntu-24.04
    needs:
      - upload-chart-nucliadb-shared
      - upload-charts-nucliadb-component
      - upload-chart-nidx
    steps:
      - name: Generate a token
        id: app-token
        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
        with:
          app-id: ${{ secrets.GHAPP_ID_NUCLIABOT }}
          private-key: ${{ secrets.PK_GHAPP_NUCLIABOT }}
          owner: nuclia

      - name: Send to promotion queue
        id: send-to-promo
        uses: peter-evans/repository-dispatch@28959ce8df70de7be546dd1250a005dd32156697 # v4.0.1
        with:
          token: ${{ steps.app-token.outputs.token }}
          repository: nuclia/core-apps
          event-type: promotions
          client-payload: |-
            {
              "commit-sha": "${{ github.sha }}",
              "components": [
                {
                  "chart-version": "${{ needs.upload-charts-nucliadb-component.outputs.version_number }}",
                  "component": "nidx",
                  "component-type": "regional"
                },
                {
                  "chart-version": "${{ needs.upload-charts-nucliadb-component.outputs.version_number }}",
                  "component": "nucliadb-shared",
                  "component-type": "regional"
                },
                {
                  "chart-version": "${{ needs.upload-charts-nucliadb-component.outputs.version_number }}",
                  "component": "nucliadb-ingest",
                  "component-type": "regional"
                },
                {
                  "chart-version": "${{ needs.upload-charts-nucliadb-component.outputs.version_number }}",
                  "component": "nucliadb-reader",
                  "component-type": "regional"
                },
                {
                  "chart-version": "${{ needs.upload-charts-nucliadb-component.outputs.version_number }}",
                  "component": "nucliadb-search",
                  "component-type": "regional"
                },
                {
                  "chart-version": "${{ needs.upload-charts-nucliadb-component.outputs.version_number }}",
                  "component": "nucliadb-train",
                  "component-type": "regional"
                },
                {
                  "chart-version": "${{ needs.upload-charts-nucliadb-component.outputs.version_number }}",
                  "component": "nucliadb-writer",
                  "component-type": "regional"
                }
              ],
              "environment": "${{ inputs.environment }}",
              "promo_production": false,
              "skip_argo_health": false,
              "skip_promo_queue": false,
              "slack_team": "S06B7JZMC76",
              "team": "nucliadb",
              "tests": {
                "run-e2e": true,
                "run-nuclia-e2e": true
              }
            }